1. Cross Reference To Related Applications
The subject matter of the present application is related to the subject matter disclosed in co-pending and commonly assigned U.S. patent application Ser. No. 09/272,056, entitled “Methods And Systems For Single Sign-On Authentication In A Multi-Vendor E-Commerce Environment And Directory-Authenticated Bank Drafts” filed on Mar. 18, 1999; Ser. No. 09/405,741, entitled “Methods And Systems For Carrying Out Directory-Authenticated Electronic Transactions Including Contingency Dependent Payments Via Secure Electronic bank Drafts” filed on Sep. 24, 1999 and Ser. No. 09/490,738, entitled “eDropShip: Methods And Systems For Anonymous E-Commerce Shipment” filed on Jan. 24, 2000, the disclosures of which are hereby incorporated herein in their entirety.
2. Field of the Invention
The present invention relates to methods and systems for providing security for corporate payments through a corporate bank (hereafter, Financial Service Provider or FSP) to a payee such as corporate partner (hereafter, Trading Partner or TP).
3. Description of the Related Art
Every corporation may be presumed to have a Chief Executive Office (CEO), Chief Financial Officer (CEO) or a person or persons that operate in that capacity. Such a person typically designates employees with authority to approve payments and/or authorize the FSP to make payments to the TP for goods and/or services provided by the TP to the corporation. To prevent fraud or mistake, such payments should be approved before the corporation's account with the FSP is debited. Preferably, the person or mechanism established to approve such pending payments should be authenticated (their identity verified to insure that the person or mechanism is who or what he, she or it purports to be) prior to the payment to the TP being released.
The primary corporate payment instruments are: paper checks, Electronic Funds Transfer (EFT), EXtensible Markup Language (XML) messages, credit cards, and purchase cards. Each payment instrument has its existing set of security models, yet none of them are totally satisfactory. All existing security models focus on given payment instruments, largely to the exclusion of the others. Alternatively, security risks vary widely among these methods of payment. Paper checks have the longest tradition as a payment method, which usually consists of the matching of a signature on the check against a signature on a signature card. Some checks of high value may require two signatures to be valid. However, for efficiency reasons, signatures are not commonly examined by the FSP as they are processed, except perhaps to insure that the correct number of signatures is present. If the account has sufficient funds, the check will usually clear regardless of signature. The corporation, then, must discover any discrepancies during a reconciliation process, applying to the FSP to reverse check and charges as appropriate. This results in contention between the FSP and the corporation, as the FSP tries to shift assumption of the risk of bad checks to the corporation, while the corporation typically believes the FSP should assume this responsibility. This is an ongoing problem for many corporations and their FSPs.
In a typical scenario, the FSP receives checks for clearing against the corporation's account until 2 pm (for example) each day. In addition, the FSP accumulates pending payment requests from servers used by the corporation. Such requests may not have digital signatures. If they do not, the FSP typically has no non-repudiable means of determining the legitimacy of the payment request. The paper checks received for clearing against the corporation's account may or may not be legitimate. FSPs typically no longer inspect signatures and compare them against signature cards unless they have received a specific request to do so. At the end of the business day (such as at 5 pm, for example), the FSP debits the corporation's account for the amounts in the received payment requests and correspondingly credits the accounts of the purported payees. The FSP will then typically print a statement at the end of the month and send it securely to an authorized person at the corporation for reconciliation against the corporation's accounting system.
EFTs are customarily handled by agreement between corporations and their FSPs, with some electronic banking systems permitting EFTs. Some EFTs and corporations rely on security based upon a combination of an ID and a password, with or without private networking (such as a Virtual Private Network or VPN) and Public Key Infrastructure (PKI) certificates. EFT security typically requires a signature on paper to back up whatever other security means have been selected. Moreover, the measures aimed at securing EFTs are usually applicable only to EFT payments.
XML payments are under development by a variety of providers of services and technology. Typically, an XML payment system will include authorization through PKI certificate by a person identified through the certificate. The ancillary procedures, that is, the means by which certificates are generated and distributed, varies widely—in some cases, third party vendors participate in the security arrangements. Most such XML efforts have FSP sponsorship and may be presumed to have very high standards of security. None of the known systems for XML security either integrate with corporate Enterprise Resource Planning (ERP) systems or internal FSP procedures.
Credit cards are discrete instruments designated by an account number and an expiration date, both of which are known to the holder of the card. Unfortunately, these are easily learned by others and credit cards have historically not been regarded has having strong security. Federal law requires FSPs to assume responsibility for unauthorized charges over $50. However, FSPs would like to find others (usually the vendor who accepted the card—the payee) to take responsibility for the unauthorized charge. The usual control is that purchases made with credit cards are subject to predetermined limits. The only security measure usually associated with credit cards is that the merchant will verify by signature/picture on the physical card before submitting the purchase request to the card issuer. However, merchants rarely, in practice, compare the signature on the receipt with that appearing on the card. Moreover, such thin security measures are not typically available for purchases made over the telephone or Internet. Credit card fraud is a major problem in the U.S. and an even greater problem elsewhere. Such fraud affects both business and personal payments.
Purchase Cards (Pcards) are corporate credit cards that have high limits relative to credit cards. Pcards may be physically implemented as plastic cards, but their main function lies in supporting payments for corporate purchases over the facsimile, telephone or the Internet. The security provisions for Pcards vary widely, with ID/password being the highest level and none at all (use of the card number on a paper form) being the lowest.
Corporate use of credit cards and Pcards usually costs the corporation and the TP some fee paid to the FSP. Unlike consumer credit cards, the main risk involves fraud or improper use by unauthorized individuals rather than non-payment by the holder of the card. Even so, corporate losses could be considerable, as could those of the FSP. The TP is in a quandary, since there is no basis other than the means of communication for believing that a card number is valid and is being properly used. Faxed orders with the credit card number on the fax would be an example of security for the TP.
What are needed, therefore, are methods and systems for insuring strong security for all forms of corporate payments. What are also needed are methods and systems for insuring that the individual or mechanism that approves the corporate payments has the authority to approve the payments; that is, has the right to bind the corporate to pay the authorized payments.